Classic ASP and IIS7 Web Gardens

We have many small Classic ASP applications now running on IIS7.5 / Windows 2008 R2.

Since we completed our migration from IIS5 we encountered some inconsistent behaviour around Classic ASP and Session State. It appeared that the session would intermittently be lost and then re-appear when re-submitting pages etc.

We eventually discovered that this issue was being caused by the Application Pool being configured to function as a Web Garden i.e. Maximum Worker Processes was set to > 1. When we reset the number of processes to 1 the Session State is now working as expected.

The same must apply to IIS6 as per the article which pointed us towards the solution: IIS 6.0 Session State May Be Lost If You Use Web Gardens with ASP Applications

SelfSSL for IIS

Install the 'IIS6 Resource Kit' from here: http://www.microsoft.com/downloads/details.aspx?FamilyID=56fc92ee-a71a-4c73-b628-ade629c89499&DisplayLang=en

Note: Although this is the ISS6 Resource Kit it also works for IIS 5. Just copy the selfssl.exe to your Windows 2000 server.

Log into the server that requires the certificate renewal with local administrator rights:

1. Go to ‘Start’ – ‘Programs’ – ‘IIS Resources’ – ‘SelfSSL’ choose ‘SelfSSL’
2. Type in ‘selfssl.exe /N:CN=/K:1024 /V:1095 /S:1 /P:443 /T’ with the correct server name for example: ‘selfssl.exe /N:CN=SERVERABC123 /K:1024 /V:1095 /S:1 /P:443 /T’
3. Select ‘Enter’
4. When you receive the message ‘Do you want to replace the SSL settings for site 1 (Y/N)?’ pres ‘Y’
5. You should receive the message ‘The self signed certificate was successfully assigned to site 1.’

For IIS7 see ScottGu's tutorial here: Enabling SSL on IIS 7.0 Using Self-Signed Certificates

Setting up an IIS6 Application Pool Identity

Annoyingly I keep forgetting the 'User Rights Assignments' to be assigned when setting up an IIS6 app pool to run under a different identity i.e. a domain user. They are listed nicely on Peter Stromquist's blog here:

• Add the account to the local IIS_WPG security group
• Open the Group Policy Editor for the local computer (gpedit.msc)
• Drill down to: Local Computer Policy/Computer Configuration/Windows Settings/Security Settings/Local Policies/User Rights Assignments
• Add the new identity account to the following polices:
  - Adjust memory quotas for a process
  - Logon as a service
  - Replace a process level token
• If your web application is going to host any web services, you need to also give your account Delete access to the C:\WINDOWS\Temp directory. Note: this is done via the Advanced dialog in the Security page of the Explorer folder properties dialog box